Skip to content

SonarIaC 1.21.0.5999

Compare
Choose a tag to compare
@petertrr petertrr released this 27 Sep 14:54
· 683 commits to master since this release
d1de870

Release notes - SonarIac - 1.21

Bug

SONARIAC-1103 `ArgumentSplitter` shouldn't split command by separator inside quotes

SONARIAC-1105 Dockerfile as a symbol link in a repository should not cause IllegalStateException

False-Positive

SONARIAC-1097 S6597 should not raise an issue when using HEREDOC

SONARIAC-1106 S6500 should not raise an issue when `--no-install-recommends` option is after the `install` command

SONARIAC-1118 S6470 should not raise an issue when COPY Instruction contains HereDoc

False Negative

SONARIAC-771 S6505 should raise an issue for standalone yarn commands

SONARIAC-1092 S6506 should raise an issue if sensitive https request is encapsulated in quotes

New Feature

SONARIAC-583 S6437: RUN instructions containing hardcoded secrets

SONARIAC-720 S6570: Detect missing double quote to prevent globbing and word splitting

SONARIAC-721 S6574: A space before the equal sign in key-value pair may lead to unintended behavior

SONARIAC-728 S6579: Access variable which is not available in the current scope

SONARIAC-729 S6573: Expanded filenames should not become options

SONARIAC-730 S6581: Environment variables should not be unset on a different layer than they were set

SONARIAC-732 S6584: Consent flag should be set to avoid manual input

SONARIAC-733 S6586: Deprecated instruction should not be used

SONARIAC-736 S6587: Cache should be cleaned after package installation

SONARIAC-740 S6595: Update cache and install packages in single RUN instruction

SONARIAC-741 S6589: Dockerfile should only have one ENTRYPOINT and CMD instruction

SONARIAC-744 S6596: Specific version tag for image should be used

SONARIAC-747 S6597: WORKDIR instruction should be used instead of cd command

SONARIAC-1069 Allow users to define their own Dockerfile pattern

Improvement

SONARIAC-1075 Remove S6497 from SonarWay

SONARIAC-1079 `ArgumentDetector` should be able to separate different commands of a single instruction